JWT generator

When you develop or test an API that uses JSON Web Tokens, you often need a token with specific claims: a particular user ID, a role, or an expiry in the past to test error handling. This generator builds a JWT from your header and payload and signs it with HMAC-SHA256 (HS256) using a secret you provide.

How to use it

1. Edit the header; for HS256 it is normally { 'alg': 'HS256', 'typ': 'JWT' } with double quotes.
2. Edit the payload claims.
3. Enter the secret your API uses to verify tokens.
4. Copy the token and send it in the Authorization: Bearer header.

How the token is built

1. The header and payload are serialized as JSON and Base64URL-encoded. The standard HS256 header always encodes to eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
2. The signature is HMAC-SHA256(header + '.' + payload, secret), also Base64URL-encoded.
3. The three parts are joined with dots: header.payload.signature.

Useful registered claims

• sub: the subject, usually the user ID.
• iat: issued-at time, as a Unix timestamp in seconds.
• exp: expiry time in seconds. 1893456000 is 1 January 2030 00:00 UTC.
• nbf: not valid before this time.
• iss and aud: issuer and audience, which servers should check.

Security notes

• The payload is only encoded, not encrypted. Anyone can read it, so never put passwords or secrets in it.
• For HS256, use a random secret of at least 256 bits (32 bytes). Short secrets can be brute-forced offline.
• Use test secrets here, not production signing keys.